Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 725 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.088 | 5,9 % |
| <10 % | 347.080 | 93,0 % |
GitLab Patches Second 10.0 RCE Flaw in October, Forcing Another Security Update
GitLab's latest critical RCE patch fixes CVE-2026-110264, leaving servers updated on October 12 exposed. Check affected versions and security guidance. This article has been indexed from eSecurityPlanet Read the original article: GitLa
Inside CVE-2026-109618: how PHP's out-of-memory path became a remote code execution bug
Inside CVE-2026-109618: how PHP's out-of-memory path became a remote code execution bug PHP's memory limit is meant to protect a server from a runaway script. On 21 October 2026 the PHP project shipped fixes for a flaw that turns
Dirty Frag v2.0 (ZDI-CAN-33367): Linux Kernel Local Root Zero-Day, Mitigation for CloudLinux
📋 TL;DR: last updated 23 October 2026, 14:00 UTCDirty Frag v2.0 (ZDI-CAN-33367, no CVE assigned) is a flaw in the Linux kernel networking stack that lets any local user rewrite files they can only read, which leads to root. Public exploit c
New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data
Researchers has demonstrated Node2Shell, a working exploit that lets an attacker run code inside a Node.js application through specially crafted, Brotli-compressed data. The research targets CVE-2026-111497, a high-severity memory flaw in t
CVE-2026-114357 | DJI CrystalSky up to 0.6.6.9 adbd /system/bin/adbd_tcp.sh missing authentication (EUVD-2026-108990)
A vulnerability marked as very critical has been reported in DJI CrystalSky up to 0.6.6.9. Impacted is an unknown function of the file /system/bin/adbd_tcp.sh of the component adbd. This manipulation causes missing authentication. This vuln
CVE-2026-57207 | NetboxLabs Netbox Mcp Server up to 1.2.0 HTTP Endpoint missing authentication (EUVD-2026-108992)
A vulnerability labeled as problematic has been found in NetboxLabs Netbox Mcp Server up to 1.2.0. This issue affects some unknown processing of the component HTTP Endpoint. The manipulation results in missing authentication. This vulnerabi
CVE-2026-114621 | baserproject BaserCMS up to 5.3.1/5.4.1 Admin/Api/Admin Actions contain/conditions/fields/finder/order sql injection (EUVD-2026-108991)
A vulnerability, which was classified as problematic, was found in baserproject BaserCMS up to 5.3.1/5.4.1. Affected is an unknown function of the component Admin/Api/Admin Actions. The manipulation of the argument contain/conditions/fields
CVE-2026-114622 | baserproject BaserCMS up to 5.2.3/5.3.1/5.4.0/5.4.1 Admin API update fullpath path traversal (EUVD-2026-108993)
A vulnerability was found in baserproject BaserCMS up to 5.2.3/5.3.1/5.4.0/5.4.1. It has been rated as problematic. Affected by this issue is the function ThemeFilesService::update of the component Admin API. Performing a manipulation of th
CVE-2026-114624 | baserproject BaserCMS up to 5.3.1/5.4.1 Widget-Area Entity unserialize deserialization (EUVD-2026-108995)
A vulnerability categorized as problematic has been discovered in baserproject BaserCMS up to 5.3.1/5.4.1. This affects the function unserialize of the component Widget-Area Entity. Executing a manipulation can lead to deserialization. The
CVE-2026-114623 | baserproject BaserCMS up to 5.3.1/5.4.1 BcThemeFile config/install.php parseArgs path traversal (EUVD-2026-108994)
A vulnerability was found in baserproject BaserCMS up to 5.3.1/5.4.1. It has been classified as problematic. Affected is the function ThemeFilesController::parseArgs of the file config/install.php of the component BcThemeFile. This manipula
CVE-2026-98897 | Linux Kernel up to 6.18.52 ksmbd cifs.ko wait_for_break_ack locking (EUVD-2026-108853)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.18.52. This issue affects the function wait_for_break_ack of the file cifs.ko of the component ksmbd. This manipulation causes improper locking. This
CVE-2026-98899 | Linux Kernel up to 6.18.52 ipset locking (EUVD-2026-108855)
A vulnerability was found in Linux Kernel up to 6.18.52. It has been classified as very critical. This affects an unknown function of the component ipset. The manipulation leads to improper locking. This vulnerability is referenced as CVE-2
CVE-2026-98898 | Linux Kernel up to 6.18.52 Sienna Cichlid Driver si.c race condition (EUVD-2026-108854)
A vulnerability described as very critical has been identified in Linux Kernel up to 6.18.52. Affected by this issue is some unknown functionality of the file si.c of the component Sienna Cichlid Driver. Executing a manipulation can lead to
CVE-2026-98901 | Linux Kernel up to 6.6.157/6.12.110/6.18.52 ksmbd behavioral workflow (EUVD-2026-108857)
A vulnerability has been found in Linux Kernel up to 6.6.157/6.12.110/6.18.52 and classified as very critical. The affected element is an unknown function of the component ksmbd. Performing a manipulation results in enforcement of behaviora
CVE-2026-98900 | Linux Kernel up to 6.18.52 xen/gntalloc drivers/xen/gntalloc.c gntalloc_ioctl_alloc allocation of resources (EUVD-2026-108856)
A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.18.52. This affects the function gntalloc_ioctl_alloc of the file drivers/xen/gntalloc.c of the component xen/gntalloc. The manipulation results in all
CVE-2026-98904 | Linux Kernel up to 6.12.110/6.18.52 mailbox devm_pm_runtime_enable race condition (EUVD-2026-108860)
A vulnerability labeled as very critical has been found in Linux Kernel up to 6.12.110/6.18.52. Affected is the function devm_pm_runtime_enable of the component mailbox. Such manipulation leads to race condition. This vulnerability is docum
CVE-2026-98903 | Linux Kernel up to 6.12.110/6.18.52 mailbox/imx imx_mu_isr/imx_mu_shutdown race condition (EUVD-2026-108859)
A vulnerability was found in Linux Kernel up to 6.12.110/6.18.52 and classified as very critical. The impacted element is the function imx_mu_isr/imx_mu_shutdown of the component mailbox/imx. Executing a manipulation can lead to race condit
CVE-2026-98902 | Linux Kernel up to 6.18.52 md/raid5 comparison (EUVD-2026-108858)
A vulnerability, which was classified as very critical, was found in Linux Kernel up to 6.18.52. Impacted is an unknown function of the component md/raid5. Such manipulation leads to incorrect comparison. This vulnerability is uniquely iden
CVE-2026-98905 | Linux Kernel up to 6.12.110/6.18.52 amdkfd set_queue_properties_from_criu buffer overflow (EUVD-2026-108861)
A vulnerability identified as very critical has been detected in Linux Kernel up to 6.12.110/6.18.52. This impacts the function set_queue_properties_from_criu of the component amdkfd. This manipulation causes buffer overflow. This vulnerabi
CVE-2026-98907 | Linux Kernel up to 6.18.52 btrfs sb_write_pointer/read_cache_page_gfp race condition (EUVD-2026-108863)
A vulnerability classified as very critical was found in Linux Kernel up to 5.15.221/6.1.188/6.6.157/6.12.110/6.18.52. This vulnerability affects the function sb_write_pointer/read_cache_page_gfp of the component btrfs. The manipulation res
CVE-2026-98906 | Linux Kernel up to 6.12.110/6.18.52 lan966x lan966x_fdma_reload state issue (EUVD-2026-108862)
A vulnerability marked as critical has been reported in Linux Kernel up to 6.12.110/6.18.52. Affected by this vulnerability is the function lan966x_fdma_reload of the component lan966x. Performing a manipulation results in state issue. This
CVE-2026-98909 | Linux Kernel up to 6.18.52 cpsw_new cpsw_probe denial of service (EUVD-2026-108865)
A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.18.52. This impacts the function cpsw_probe of the component cpsw_new. Such manipulation leads to denial of service. This vulnerability is referenced a
CVE-2026-98908 | Linux Kernel up to 6.6.157/6.12.110/6.18.52 sparx5 sparx5_tc_flower_psfp_setup memory leak (EUVD-2026-108864)
A vulnerability classified as problematic has been found in Linux Kernel up to 6.6.157/6.12.110/6.18.52. This affects the function sparx5_tc_flower_psfp_setup of the component sparx5. The manipulation leads to memory leak. This vulnerabilit
CVE-2026-98911 | Linux Kernel up to 6.18.52 dpaa2-switch dpaa2_switch_rx memory corruption (EUVD-2026-108867)
A vulnerability was found in Linux Kernel up to 5.15.221/6.1.188/6.6.157/6.12.110/6.18.52. It has been declared as very critical. This affects the function dpaa2_switch_rx of the component dpaa2-switch. Executing a manipulation can lead to
CVE-2026-98910 | Linux Kernel up to 6.6.157/6.12.110/6.18.52 amdkfd drm/amdkfd kfd_dbg_trap_enable race condition (EUVD-2026-108866)
A vulnerability has been found in Linux Kernel up to 6.6.157/6.12.110/6.18.52 and classified as very critical. Affected is the function kfd_dbg_trap_enable of the file drm/amdkfd of the component amdkfd. This manipulation causes race condit
CVE-2026-98913 | Linux Kernel up to 6.1.188/6.6.157/6.12.110/6.18.52 thunderx nicvf_probe memory leak (EUVD-2026-108869)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.1.188/6.6.157/6.12.110/6.18.52. Impacted is the function nicvf_probe of the component thunderx. This manipulation causes memory leak. The identification of thi
CVE-2026-98912 | Linux Kernel up to 6.18.52 ALSA OSS Sequencer snd_seq_oss_read buffer overflow (EUVD-2026-108868)
A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.18.52. This issue affects the function snd_seq_oss_read of the component ALSA OSS Sequencer. The manipulation results in buffer overflow. This vulnerab
CVE-2026-98915 | Linux Kernel up to 6.1.188/6.6.157/6.12.110/6.18.52 video-i2c video_unregister_device denial of service (EUVD-2026-108871)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.1.188/6.6.157/6.12.110/6.18.52. This affects the function video_unregister_device of the component video-i2c. This manipulation causes denial of servi
CVE-2026-98914 | Linux Kernel up to 6.18.52 amdgpu infinite loop (EUVD-2026-108870)
A vulnerability was found in Linux Kernel up to 6.18.52. It has been rated as problematic. This vulnerability affects unknown code of the component amdgpu. The manipulation leads to infinite loop. This vulnerability is uniquely identified a
CVE-2026-98916 | Linux Kernel up to 6.6.159/6.12.113/6.18.52 nl80211 input validation (EUVD-2026-108872)
A vulnerability labeled as very critical has been found in Linux Kernel up to 6.6.159/6.12.113/6.18.52. The affected element is an unknown function of the component nl80211. Such manipulation leads to improper input validation. This vulnera
CVE-2026-114649 | MongoDB C# Driver up to 3.12.x TLS Client Certificate Comparison certificate validation (WID-SEC-2026-4126)
A vulnerability classified as problematic was found in MongoDB C# Driver up to 3.12.x. The affected element is an unknown function of the component TLS Client Certificate Comparison. The manipulation results in improper certificate validati
CVE-2026-114648 | MongoDB C# Driver up to 3.12.x LINQ Query Processing neutralization (WID-SEC-2026-4126)
A vulnerability categorized as very critical has been discovered in MongoDB C# Driver up to 3.12.x. This vulnerability affects unknown code of the component LINQ Query Processing. Such manipulation leads to improper neutralization. This vul
CVE-2026-114647 | MongoDB C# Driver up to 3.12.x Document Replacement Validation FindOneAndReplace input validation (WID-SEC-2026-4126)
A vulnerability identified as problematic has been detected in MongoDB C# Driver up to 3.12.x. Affected by this issue is the function FindOneAndReplace of the component Document Replacement Validation. This manipulation causes improper inpu
CVE-2026-114646 | MongoDB C# Driver up to 3.12.x BSON input validation (WID-SEC-2026-4126)
A vulnerability was found in MongoDB C# Driver up to 3.12.x. It has been classified as critical. The affected element is an unknown function of the component BSON Handler. Performing a manipulation results in improper input validation. This
CVE-2026-114644 | MongoDB C# Driver up to 3.12.x Deserialization resource consumption (WID-SEC-2026-4126)
A vulnerability was found in MongoDB C# Driver up to 3.12.x. It has been declared as critical. This impacts an unknown function of the component Deserialization. Executing a manipulation can lead to resource consumption. This vulnerability
CVE-2026-114643 | MongoDB C# Driver up to 3.12.x input validation (WID-SEC-2026-4126)
A vulnerability was found in MongoDB C# Driver up to 3.12.x. It has been declared as problematic. Affected by this issue is some unknown functionality. The manipulation results in improper input validation. This vulnerability is reported as
CVE-2026-106017 | OpenVPN up to 3.11.7 Core certificate validation (WID-SEC-2026-4127)
A vulnerability was found in OpenVPN up to 3.11.7. It has been rated as problematic. Impacted is an unknown function of the component Core. The manipulation leads to improper certificate validation. This vulnerability is listed as CVE-2026-
CVE-2026-98878 | Linux Kernel up to 6.18.52 irqchip-gic-v5 irq_eoi denial of service (EUVD-2026-108672)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.18.52. Affected by this issue is the function irq_eoi of the component irqchip-gic-v5. The manipulation leads to denial of service. This vulnerability
CVE-2026-98877 | Linux Kernel up to 6.18.52 irqchip-gic-v4 __irq_domain_instantiate null pointer dereference (EUVD-2026-108723)
A vulnerability classified as problematic was found in Linux Kernel up to 6.18.52. Affected by this vulnerability is the function __irq_domain_instantiate of the component irqchip-gic-v4. Executing a manipulation can lead to null pointer de
CVE-2026-98880 | Linux Kernel up to 6.6.157/6.12.110/6.18.52 ntfs3 set_blocksize buffer overflow (EUVD-2026-108674)
A vulnerability marked as problematic has been reported in Linux Kernel up to 6.6.157/6.12.110/6.18.52. This affects the function set_blocksize of the component ntfs3. This manipulation causes buffer overflow. This vulnerability appears as
CVE-2026-98879 | Linux Kernel up to 6.18.52 isofs set_blocksize buffer overflow (EUVD-2026-108673)
A vulnerability labeled as problematic has been found in Linux Kernel up to 6.18.52. The impacted element is the function set_blocksize of the component isofs. The manipulation results in buffer overflow. This vulnerability is reported as C
CVE-2026-98882 | Linux Kernel up to 6.12.110/6.18.52 wave5 wave5-vpuapi.c wave5_vpu_dec_get_output_info frame_buf buffer overflow (EUVD-2026-108676)
A vulnerability described as very critical has been identified in Linux Kernel up to 6.12.110/6.18.52. This impacts the function wave5_vpu_dec_get_output_info of the file drivers/media/platform/chips-media/wave5/wave5-vpuapi.c of the compon
CVE-2026-98881 | Linux Kernel up to 6.18.52 Bridge Multicast br_multicast.c br_multicast_dev_del infinite loop (EUVD-2026-108675)
A vulnerability classified as critical has been found in Linux Kernel up to 6.18.52. Affected is the function br_multicast_dev_del of the file net/bridge/br_multicast.c of the component Bridge Multicast. Performing a manipulation results in
CVE-2026-114486 | Devolutions Server up to 2026.3.10 Token Generation improper authorization (WID-SEC-2026-4128)
A vulnerability, which was classified as problematic, was found in Devolutions Server up to 2026.3.10. The impacted element is an unknown function of the component Token Generation. The manipulation results in improper authorization. This v
CVE-2026-114485 | Devolutions Server up to 2026.3.10 User List Endpoint information disclosure (WID-SEC-2026-4128)
A vulnerability has been found in Devolutions Server up to 2026.3.10 and classified as problematic. This affects an unknown function of the component User List Endpoint. This manipulation causes information disclosure. This vulnerability ap
CVE-2026-93981 | honojs hono up to 4.13.6 JSX Rendering hono/jsx/dom/server renderToString/renderToReadableStream cross site scripting (WID-SEC-2026-4131)
A vulnerability categorized as problematic has been discovered in honojs hono up to 4.13.6. Impacted is the function renderToString/renderToReadableStream of the file hono/jsx/dom/server of the component JSX Rendering. The manipulation resu
CVE-2026-84365 | honojs Hono up to 4.13.4 Static Site Generation toSSG ssgParams path traversal (WID-SEC-2026-4131)
A vulnerability categorized as problematic has been discovered in honojs Hono up to 4.13.4. This affects the function toSSG of the component Static Site Generation. Such manipulation of the argument ssgParams leads to path traversal. This v
CVE-2026-84364 | honojs Hono up to 4.13.4 Dot-notation Parsing parseBody resource consumption (WID-SEC-2026-4131)
A vulnerability was found in honojs Hono up to 4.13.4. It has been classified as problematic. Affected is the function parseBody of the component Dot-notation Parsing. The manipulation leads to resource consumption. This vulnerability is li
CVE-2026-84363 | honojs Hono up to 4.13.4 Cache Middleware cross site scripting (WID-SEC-2026-4131)
A vulnerability was found in honojs Hono up to 4.13.4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Cache Middleware. This manipulation causes cross site scripting. This vulnerabili
Hacking-Wettbewerb Pwn2Own - 98 neue Zero-Day-Schwachstellen entdeckt
Ethical-Hacking-Wettbewerb Pwn2Own der Zero Day Initiative entdeckten und meldeten 98 bislang unbekannte Zero Day Schwachstellen. Weiterlesen
Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems
Hewlett Packard Enterprise (HPE) has addressed a critical authentication-bypass vulnerability in the SSH daemon of its AOS-8 wireless operating system. This vulnerability, tracked as CVE-2026-79855, could let a remote, unauthenticated attac
CVE-2026-114645 | MongoDB C Driver up to 1.30.13/2.5.6 Kerberos Authentication out-of-bounds write (WID-SEC-2026-4134)
A vulnerability identified as critical has been detected in MongoDB C Driver up to 1.30.13/2.5.6. This issue affects some unknown processing of the component Kerberos Authentication. Performing a manipulation results in out-of-bounds write.
URGENT – PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an un
CVE-2026-113869 | Mozilla Thunderbird up to 158.0.0 use after free (WID-SEC-2026-4064)
A vulnerability categorized as problematic has been discovered in Mozilla Thunderbird up to 158.0.0. This issue affects some unknown processing. The manipulation results in use after free. This vulnerability is identified as CVE-2026-113869
CVE-2026-113868 | Mozilla Thunderbird up to 158.0.0 NTLM Authentication out-of-bounds (WID-SEC-2026-4064)
A vulnerability was found in Mozilla Thunderbird up to 158.0.0. It has been rated as problematic. This vulnerability affects unknown code of the component NTLM Authentication. The manipulation leads to out-of-bounds read. This vulnerability
CVE-2026-113867 | Mozilla Thunderbird up to 158.0.0 Chat injection (WID-SEC-2026-4064)
A vulnerability was found in Mozilla Thunderbird up to 158.0.0. It has been declared as problematic. This affects an unknown part of the component Chat. Executing a manipulation can lead to injection. The identification of this vulnerabilit
CVE-2026-113866 | Mozilla Thunderbird up to 158.0.0 AutoDiscover service cleartext transmission (WID-SEC-2026-4064)
A vulnerability was found in Mozilla Thunderbird up to 158.0.0. It has been classified as problematic. Affected by this issue is some unknown functionality of the component AutoDiscover service. Performing a manipulation results in cleartex
Nach Sicherheitslücke: Internetseite des Saalekreises bleibt vorsorglich offline
Cybersicherheit im Saalekreis Nach Sicherheitslücke: Internetseite des Saalekreises bleibt vorsorglich offline. Nach den Warnungen vor einer ... Weiterlesen
CVE-2026-112863 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.
CVE-2026-115730 | i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-r